Sure, you need both. I said, > CFLAGS hardening works, in addition to ASLR, it's the last line of defense for all C programs. [...] Using mitigation technique

Sure, you need both. I said, > CFLAGS hardening works, in addition to ASLR, it's the last line of defense for all C programs. [...] Using mitigation techniques and sandbox-based isolation are the only two ways to limit the damage. Mitigations are here to limit the damage, not to eliminate vulnerabilities and exploits. Looking for bugs and improving the code for security for as hard as you can, and in case you missed one (you certainly will), CFLAGS and ASLR is your last line of defense, and you can only hope for the best that it is able to buy you some time to patch it, before a better exploit appears...